Automate CMMC readiness with adaptive compliance

CMMC is the Department of Defense’s (DoD’s) program for verifying that contractors have implemented required cybersecurity practices. It’s codified at 32 CFR Part 170.

It exists because self-attestation alone proved insufficient. CMMC introduces levels, defines who may assess, and sets what has to be submitted — turning "we’ve implemented it" into something checkable.

NIST 800-171 sets the security requirements for protecting CUI (Controlled Unclassified Information). CMMC is the program that verifies you’ve met them — establishing levels, who can assess, and what gets submitted.

They aren’t interchangeable, and the levels aren’t simply 800-171 at increasing depth. Level 1 covers Federal Contract Information and isn’t 800-171 at all. Level 2 is where they align. Level 3 adds enhanced requirements.

And 800-171 reaches beyond defense — civilian agencies reference it on contracts where CMMC never applies.

Level 1 — basic safeguarding of Federal Contract Information (FCI), drawing on FAR 52.204-21. This is a smaller set, and about FCI rather than CUI (Controlled Unclassified Information).

Level 2 closely mirrors the NIST 800-171 requirements. This is where most contractors who handle CUI land.

Level 3 — Level 2 plus enhanced requirements for the most sensitive work.

Which applies to your business is set by your contract, not by choice.

Phase I is in force. Phase II is currently suspended.

Level 1 and Level 2 self-assessment requirements under Phase I remain current and valid. On 13 July 2026, the Department announced the immediate suspension of Phase II requirements, which had been scheduled to begin 10 November 2026. That suspension does not change Phase I obligations.

This is the most fluid part of the program. Confirm current status against the Department’s own pages before making commitments based on any published timeline. Meanwhile, Iru constantly monitors authoritative sources to reflect the updates that matter for your business within our Compliance Automation solution.

Revision 2 — even though NIST (The National Institute of Standards and Technology) has withdrawn it.

NIST published Revision 3 and marked Revision 2 as withdrawn on its website. But CMMC assessments are conducted against Revision 2, under a class deviation memo, until that memo is withdrawn or superseded. You may implement Revision 3 voluntarily, but must use the Department’s Organization-Defined Parameters from the April 2025 memorandum.

Reading NIST’s site and concluding you should move to Rev 3 is a reasonable mistake with contractual consequences.

Usually yes, if you handle FCI or CUI. The requirement flows down through the supply chain, and your prime will need to demonstrate that it did.

Subcontractors are frequently where supply chain assessments find their gaps, which is why primes have moved from accepting assurances to asking for evidence.

No. CMMC applies to the defense supply chain. If you have no federal or defense customers, it isn’t your framework — and neither is 800-171.

If you’re building a security program without a specific contractual driver, NIST CSF 2.0 is the more useful starting point.

SPRS — the Supplier Performance Risk System — is where your assessment results and your annual affirmation get submitted. It’s the system of record your prime contractor and the Department look at.

A POA&M — Plan of Action and Milestones — is a time-boxed plan to close a gap you haven’t closed yet. Whether you can use one depends on your level:

• Level 1 — never. Every requirement has to be met.
• Levels 2 and 3 — only if you score at least 88 out of 110, and only for the lowest-weighted requirements. You then have 180 days to close it.

The detail most teams miss: at Level 2 the assessment happens every three years, but the affirmation is annual. Two years out of three, that submission is the only thing standing between you and a lapse.

No platform can. Your assessment is conducted by you or by an authorized third party depending on your level, and the outcome depends on your system boundary, your policies, your people and your evidence.

What Iru does is the technical requirements underneath, and it takes the platform rather than the compliance product alone. Iru Workforce Identity enforces access control and multi-factor authentication on the identities that reach CUI. Iru Endpoint Management maintains secure configuration and governs media and device disposal. Iru Vulnerability Management keeps software patched. Iru Endpoint Detection & Response detects and contains incidents. Iru Compliance Automation collects the evidence from all of them continuously, so your assessment reflects current state rather than a scramble before the deadline.

If you need an assessment, we can connect you with one of the assessors in our auditor network. Book a demo to explore the compliance solution, or if you’re already a customer, reach out to your rep for details on our audit partners.